How to comply with recital 1 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 1 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 1 sets a misleading equivalence: TIBER-EU (or its national implementation TIBER-LU) only counts in as much as it stays consistent with Articles 26 and 27 of DORA and this RTS. Many Luxembourg financial entities assume that a test run the TIBER way automatically ticks the DORA box. Wrong: the CSSF, the TLPT authority under Article 46 of DORA, checks real compliance with RTS 2025/1190, not the mere reference to the framework. A TIBER-LU test that is incomplete on the scope of critical functions or on the inclusion of ICT providers (CSSF circulars 22/806 and 25/882) will be found non-compliant despite the label.The governance grey zones to clarify before you launchThis recital layers three authorities that must be clearly distinguished in your test file:The CSSF is the competent TLPT authority at national level (Article 26(9)) and runs the TIBER-LU framework with the BCL (Implementation Document revised on 20 June 2025).The ECB remains competent for significant credit institutions under its direct supervision: the national designation does not strip the ECB of its Article 46 prerogatives.Where TLPT tasks are partially delegated to another national authority (Article 26(10)), the competent authority of the entity under Article 46 remains responsible for the non-delegated tasks. Map precisely who validates what.Operational consequence: before mandating a red team, formally identify your competent authority, the TIBER-LU / RTS alignment, and the scope validation chain. The remediation from the test must then feed your ICT risk management (CSSF circular 20/750).How Luxgap automates this riskOur Luxgap TLPT Readiness Mapper makes it impossible to launch a badly scoped test by verifying, line by line, that your TIBER-LU approach complies with Articles 26-27 of DORA and RTS 2025/1190 before the red team touches production. The tool cross-references your critical functions register, your application map (Azure Sentinel, Microsoft Defender, CrowdStrike) and your ICT provider register to materialise the real test scope, with no manual questionnaire.Automatically classifies which authority is competent for your entity (CSSF, ECB for significant institutions, delegated authority under Article 26(10)) and flags the non-delegated responsibility zones.Verifies that each critical function in live production is properly covered by the scope, based on your DORA Article 8 register.Detects ICT providers that must be included in the test under CSSF circulars 22/806 and 25/882 and alerts on scope omissions.Generates a TIBER-LU to RTS 2025/1190 compliance matrix that identifies each uncovered requirement before scope validation.Produces a timestamped scoping file, opposable to the CSSF, demonstrating methodological alignment and red team / blue team / white team / threat intelligence governance.Tracks post-test remediation and injects it into your ICT risk management cycle compliant with circular 20/750.Available as a complement to a Luxgap CISO...

Recital 1

They trust us

Before we chat